How to security review pull requests written by AI coding agents
Summary
A year ago, most pull requests at a SaaS company were written by a person who'd at least skimmed the security wiki once.
Now a big share come from Claude Code, Cursor or Copilot, and they arrive faster than anyone can review them properly.
To security review a PR an agent wrote, check it against how your codebase actually works as well as against known vulnerability patterns.
Focus on access control, data handling and business logic, because that's where agent-written code most often goes wrong. And once agents are writing most of your code, run an automated security review on every PR and save human review for the changes that need it.
Why AI-written pull requests need a different review
AI coding agents are brilliant at writing code. They're less good at knowing your security standards, and a few things have changed since your PR review process was designed.
There are far more PRs. 83% of developers now use AI tools and two thirds use coding agents, and agents started more than 40% of GitHub pull requests in September, up from 17% in March.
Most teams have around one AppSec engineer for every 100 developers, so manual review was stretched before any of this.
Agents don't reliably follow your rules either. In OctoBench, a 2026 benchmark from Fudan University, MiniMax and Peking University, the best model followed every instruction in a task, across its system prompt, AGENTS.md or CLAUDE.md and tool specs, only 28% of the time, and Claude Sonnet 4.5 and Gemini 3 Pro managed about 15%.
Having your security standards written down doesn't mean the agent followed them. And the flaws are harder to spot. Agents rarely write textbook injection anymore.
They write code that compiles, passes the tests and still returns another customer's data because a team check is missing.
It's reaching production, too. Georgia Tech's Vibe Security Radar had confirmed 74 CVEs caused by AI-written code by the end of March 2026, and March alone produced more than all of 2025 combined.
The researchers behind it think the real number is five to ten times higher.
A study of 302,600 AI-authored commits across 6,299 GitHub repos found AI coding assistants introduce about 1.5 times as many security issues as they fix, and 22.7% of the issues they introduce are still there in the latest version of the code.
What to check in an AI-written pull request
Use this as a starting checklist for any PR an agent wrote:
- Access control. Does every new endpoint check who is calling and what they're allowed to see? Missing authorization checks and IDOR (one user reading another user's records by changing an ID) are easy for an agent to introduce and easy for a reviewer to miss.
- Data handling. Is sensitive data logged, returned in an API response it shouldn't be, or stored unencrypted?
- Injection. Are queries, commands or templates built from user input without validation or parameterization?
- Your own rules. Does the change follow the standards specific to your codebase? For example, "customer data must be encrypted at rest" or "every admin action is audit logged". Generic checklists can't cover these, and they're often what matters most.
- New dependencies. Did the agent add a package, or pin a version with known vulnerabilities?
- Secrets. Are there hardcoded keys, tokens or credentials anywhere in the diff?
- What's outside the diff. Does the change break an assumption somewhere else? Removing a check that another service relies on looks harmless in a 20-line diff.
Where manual review breaks down
A careful reviewer can work through that checklist. The problem is doing it on every PR, at AI speed.
Large AI-generated diffs get skimmed. Two reviewers looking at the same change flag different things.
And when someone asks what your security review actually enforces, there's no record to point to. Security review becomes a bottleneck, and then it becomes a rubber stamp.
The research says the same. A Harvard working paper covering 718 companies and 49 million pull requests found that after teams adopted coding agents, PRs went up 23% while the time to merge one went up 49%.
At one mid-sized B2B company, Carnegie Mellon and Stanford researchers found PR volume grew 3.1x while the reviewer pool grew 1.5x, and the share of PRs that got a substantive human review fell from about 39% to 21%.
Your options for automating it
The DIY route is a good way to learn what AI review can do. We wrote about where it tops out in The Ceiling for DIY Security Reviews.
How Dam Secure reviews AI-written pull requests
dam-securebotreviewed in 1m 21s
Dam Secure is code security for AI-enabled engineering teams, and PR reviews are what we're best known for. At onboarding, Dam Secure maps how your codebase fits together: services, data flows, auth and the paths an attacker could take.
Every pull request gets reviewed against that map the moment it's opened, which is how it catches the missing access check a diff alone won't show.
Findings land on the PR in under two minutes with the fix included, and developers can fix them there or hand them to their coding agent over MCP.
AI triage checks each finding for reachability and existing mitigations first, so developers see fewer than five findings per PR instead of 15 or more, and teams ship PRs 32% faster.
Findings become tracked issues that sync to Linear and Slack and close when the fix lands, and a false positive your team explains once stays gone.
We benchmark frontier models on real security findings and route each review to the one that's best for that language and vulnerability type, so PR reviews cost a fifth of a DIY setup. We publish the benchmarks, too.
Dovetail switched to Dam Secure from Claude Code Security for PR security review.
"Shortly after set-up, Dam Secure found a critical finding in a long-standing feature. It paid for itself very quickly." Doug Rathbone, VP of Engineering, Dovetail
"Our weeks-long triage has turned into days. Devs are now fixing issues live on the PR before even deploying their changes." Sebastian Vaughan, Platform Engineering Manager, Dovetail
FAQ
Can an AI coding agent security review its own code?
It can catch some issues, but the agent that wrote the code is working from the same context and blind spots that produced it. A separate review that understands your codebase catches what the agent didn't know to check.
Should humans still review AI-written PRs?
Yes, for high-risk changes like authentication, payments and data access. Automated security review handles the rest, so human reviewers can spend their time where it counts.
How long should an automated security review take?
Fast enough that developers haven't moved on to something else when it comes back. In our testing, teams stop waiting for a security review after about 7 minutes. Dam Secure reviews finish in under two, where other AI reviewers take around 10.
What vulnerabilities are most common in AI-generated code?
Business logic and access control flaws stand out, because the code works as written but breaks a security assumption.
Want to see Dam Secure review your team's PRs? Speak to our team.
.webp)